A small GitHub repo claims a reconstructed Microsoft Global Secure Access tunnel protocol, a Python rogue client, and BOFs for GSA enumeration and TokenBroker token extraction. Treat it as research tooling that needs reproduction, but the boundary it points at is serious if device posture is really self-reported and accepted by the edge.